1. Field of the Disclosure
The disclosure relates to a method for identifying memories of virtual machines that is suitable for various versions of an operating system and a computer system using the same.
2. Description of Related Art
As computer hardware cost decreases and demand for large-scale server increases, virtual machines gradually draw attentions. The virtual machine is an interface used between software and a computer system, which may provide various resources of the computer system to the software for utilization. The software is generally an operating system. Therefore, the operating system can access the resources of the computer system through the virtual machine. However, a plurality of virtual machines can be installed on the computer system, and each of the virtual machines may install different operating system. For example, the Windows operating system of Microsoft and the Linux operating system can be simultaneously installed in different virtual machines on a same computer system.
Since a coupling relationship between the operating system on the virtual machine and the computer system is loosed, and the operating system manages memory pages on the virtual machines, a virtual machine monitor (VMM) on the computer system is not easy to obtain usage states of the memory pages on the virtual machines. However, in some applications, accessing of the memory pages on the virtual machines is necessary. For example, when the memory pages of different virtual machines are shared, it is required to detect the usage states of the memory pages, or when it is determined whether the operating system is invaded by viruses, it is required to reliably identify data structures in the memory pages from a virtual machine level. One method is to write data structure information of the operating system to the VMM, and analyze the memory pages on the virtual machines according to the data structure information. However, when the version of the operating system is updated or the compile configuration of guest OS is changed, the data structure information of the operating system has to be manually updated which is time consuming. Therefore, it is required to develop a method for identifying memories of virtual machines that is suitable for various versions of the operating system.